Macro Pipeline

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:03 AM UTC
• Version: 3.0.0

Overview

This skill openly sets up autonomous pipeline work, but it gives recurring background agents broad write, command, commit, and external notification behavior without enough containment or review controls.

Review this skill carefully before installing. Use it only for repositories where unattended agent edits and commits are acceptable, avoid confidential projects unless Discord notifications are removed or tightly controlled, replace git add . with explicit file staging, and require approval or pinning before cron jobs execute mutable pipeline steps.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:74
• Finding: Persistent Autonomous Execution Through Scheduled Heartbeats<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 74-77 and 130-133 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```markdown ## Cron Setup Always use CLI, never edit openclaw.json: ```bash openclaw cron add --name "<Project> Pipeline" --agent <agent-id> --every 30m --message "Heartbeat: lee HEARTBEAT.md y ejecuta siguiente step" ``` ``` ```markdown 2. **HEARTBEAT.md siempre en workspace** — nunca en repo 3. **HEARTBEAT es immutable** — locked con `chflags uchg` 4. **Crons vía CLI** — `openclaw cron add`, nunca editar openclaw.json ``` ### Technical Analysis The Skill directs the agent to create a recurring OpenClaw cron job that executes every 30 minutes. The scheduled message instructs the agent to read `HEARTBEAT.md` and execute the next pipeline step. It also requires that the controlling heartbeat file be made immutable with `chflags uchg`. This creates cross-session persistence: pipeline activity can continue after the original Skill invocation and in the absence of an active user session. Making the instructions immutable also hinders ordinary modification or remediation. The scheduled process operates with the permissions and tool access of the configured OpenClaw agent. No expiration, maximum execution count, explicit per-run approval, or cleanup procedure is specified. ### Attack Path 1. A user or agent follows the Skill and creates `HEARTBEAT.md`. 2. The file is locked with `chflags uchg`, preventing ordinary modification. 3. The prescribed `openclaw cron add` command installs a recurring 30-minute job. 4. Each invocation causes the configured agent to read the heartbeat instructions and process a pipeline step. 5. The activity continues across sessions until the cron entry is explicitly removed and the file lock is cleared. 6. If the mutable pipeline is later modified maliciously, the persistent scheduler repeatedly provides an execution opportunity. ### Impact Assessment ...[truncated 455 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not create scheduled jobs automatically as part of Skill execution. - Require explicit, informed user approval before installing each cron entry. - Prefer bounded, one-time jobs with an expiration time or maximum execution count. - Keep `HEARTBEAT.md` user-editable; do not apply immutable filesystem flags. - Document exact cleanup commands for removing the cron entry and clearing any file flags. - Display every scheduled action and obtain confirmation before execution. - Restrict the scheduled agent to a dedicated least-privilege account and narrowly scoped tools. - Add an emergency disable mechanism that does not depend on editing an immutable file. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:48
• Finding: Mutable Pipeline Content Controls Autonomous Agent Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-18 and 48-68 **Vulnerability Type**: Untrusted instruction and command execution **Risk Level**: High ### Vulnerable Code ```markdown | `PIPELINE.md` | **Project repo** (`~/Documents/proyectos/<project>/`) | State + progress | ✅ Yes (subagents update directly) | | `HEARTBEAT.md` | **Agent workspace** (`~/.openclaw/workspace-<agent>/`) | Instructions (read-only) | ❌ No (locked with `chflags uchg`) | ``` ```markdown ### Step fields: - `engine:` — `claude-code` | `human` | `deploy` - `depends_on:` — list of step numbers that must be ✅ first - `parallel:` — list of steps that can run simultaneously - `verify:` — shell command to validate completion - `artifacts:` — outputs passed to dependent steps - `files:` — key files modified --- ## HEARTBEAT.md Format ```markdown # HEARTBEAT — <Agent Name> > ⚠️ NUNCA modifiques este archivo (HEARTBEAT.md). Es read-only. ## Pipeline activo: ~/Documents/proyectos/<project>/PIPELINE.md ## Protocolo cada heartbeat: 1. Lee el pipeline activo (ruta absoluta arriba) 2. Si hay step [PENDING] sin dependencias bloqueadas → ejecútalo 3. Marca [RUNNING YYYY-MM-DDTHH:MM] con timestamp actual 4. Ejecuta: sessions_spawn(task=..., thread=true) 5. Un step por heartbeat máximo ``` ``` ### Technical Analysis The architecture treats repository-controlled `PIPELINE.md` content as executable agent instructions while explicitly allowing subagents to modify that file. Pipeline fields include free-form task descriptions and shell-based `verify` commands. The heartbeat then directs the agent to read pending steps, execute them, and pass their tasks into `sessions_spawn`. Repository content therefore crosses an instruction and code-execution trust boundary without validation. A contributor, compromised subagent, malicious commit, or other process with repository write access can modify a pending step so that a future heartbeat interprets attacker-controlled text as an ...[truncated 1424 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Treat all `PIPELINE.md` fields as untrusted data rather than authoritative agent instructions. - Replace free-form task execution with a strict, versioned schema and an allowlist of supported operations. - Do not accept arbitrary shell commands in `verify`; use predefined validators with fixed arguments. - Reject shell metacharacters, command substitution, redirections, and commands outside the project directory. - Require explicit user approval before spawning a subagent or executing a newly added or modified step. - Record and present the pipeline diff, command, working directory, affected files, and requested tools before approval. - Require cryptographic signatures or trusted-author verification for pipeline changes used by unattended jobs. - Run spawned agents in a sandbox with minimal filesystem, network, credential, and integration access. - Pin each scheduled run to a previously approved pipeline revision so later repository edits cannot silently alter behavior. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:124
• Finding: Blanket Git Staging Can Commit Sensitive or Unrelated Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 124-128 **Vulnerability Type**: Unsafe repository staging **Risk Level**: Medium ### Vulnerable Code ```markdown ## Git Tagging Cada step completado debe crear un commit taggeado: ```bash git add . && git commit -m "pipeline/<project>/step-<N>: <step title>" ``` ``` ### Technical Analysis The prescribed command uses `git add .`, which stages all unignored changes under the current repository path. It does not limit staging to the files declared by the pipeline step or the artifacts intentionally generated by that step. A repository may contain unrelated user work, generated output, environment files, credentials, debugging logs, or attacker-planted files. If these files are not excluded by `.gitignore`, the blanket staging command adds them to the commit. Once committed, sensitive content remains in Git history even if it is removed in a later commit. The command also chains staging and committing with `&&`, leaving no required review step between collection of changes and creation of the commit. ### Attack Path 1. A sensitive, unrelated, or malicious file is created within the repository and is not covered by `.gitignore`. 2. A pipeline step completes. 3. The agent runs `git add .`. 4. Git stages the intended step output together with every other unignored change in scope. 5. The agent immediately creates the pipeline commit without inspecting the staged diff. 6. If the repository is later pushed, the unintentionally committed content is distributed to the remote and its users. ### Impact Assessment This issue can disclose credentials, configuration, source code, logs, or other project data through local or remote Git history. It can also introduce unrelated or attacker-controlled modifications into trusted pipeline commits. The direct scope is the current repository, while subsequent pushes can expand the exposure to all users and systems with access to the remote repository. ...[truncated 3 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Stage only the explicit files declared for the completed pipeline step. - Use commands such as `git add -- path/to/file1 path/to/file2` rather than `git add .`. - Validate that every target path remains within the repository and is expected for the step. - Run `git diff --cached --name-status` and `git diff --cached` before committing. - Require user approval when staged changes include undeclared or sensitive files. - Add secret scanning and repository policy checks before every automated commit. - Maintain an appropriate `.gitignore`, but do not rely on it as the sole control. - Separate staging and commit operations so validation failure can abort the commit. ]]>

other

Warning

• Location: SKILL.md:85
• Finding: Unreviewed Task Summaries Are Sent to an External Discord Channel<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 85-92 **Vulnerability Type**: Uncontrolled external data disclosure **Risk Level**: Medium ### Vulnerable Code ```markdown ## Subagent Task Template Include in the task prompt: ``` Al terminar: 1. Actualiza <absolute-path-to-PIPELINE.md>: cambia Step X de [RUNNING] a [✅ COMPLETED] con output y artifacts 2. Si fallas, marca [FAILED] con el error 3. Notifica a Discord (action=send, channel=discord, target="channel:<id>") con resumen ``` ``` ### Technical Analysis The mandatory subagent template instructs each task to send a summary to a Discord channel. No content classification, redaction, destination validation, preview, consent, or maximum-detail policy is defined. Task summaries and failure reports can contain project names, source paths, command output, error messages, artifact details, internal identifiers, or fragments of processed data. Because Discord is an external service, this creates a data boundary crossing. The risk increases if the channel identifier is incorrect, attacker-controlled, broadly accessible, or associated with a workspace whose retention policy is unsuitable for the project. ### Attack Path 1. A subagent processes project files or executes a command that produces sensitive output. 2. The task succeeds or fails and generates a summary or error description. 3. The template directs the subagent to invoke the Discord `send` action. 4. Sensitive details included in the generated message are transmitted to the configured channel without review. 5. Channel members, bots, integrations, or retained service logs gain access to the disclosed information. ### Impact Assessment The issue can disclose information available in task results and errors to an external Discord destination. The potential scope includes project metadata, internal paths, source details, artifacts, logs, and secrets accidentally included in command output. It does not independently grant additi ...[truncated 156 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make external notifications opt-in rather than mandatory. - Require explicit approval of the Discord workspace and channel identifier. - Generate a local preview and obtain confirmation before transmitting a message. - Use a minimal fixed-format notification that excludes command output, file contents, paths, and artifact data. - Redact credentials, tokens, personal data, internal identifiers, and sensitive error details. - Apply destination allowlists and prevent pipeline content from selecting arbitrary channels. - Disable external notifications for confidential projects by default. - Record notification metadata locally for auditing without storing sensitive message bodies. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill normalizes direct autonomous modification of repository files by subagents without any user-facing warning, approval checkpoint, or safety boundary. In a cron-driven autonomous workflow, this can lead to silent state changes, accidental corruption, or unauthorized edits in tracked project files.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs operators to configure recurring cron-based autonomous execution without prominently warning that the agent will continue acting in the background. Persistent unattended execution materially increases risk by enabling repeated file modifications, task execution, and possible misuse long after the initiating user interaction has ended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs agents to send task summaries to Discord without warning that repository or operational information may be transmitted to an external service. This creates a clear privacy and data leakage risk, especially when failure messages, artifacts, or summaries may contain sensitive project details.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs subagents to send Discord notifications even though the declared purpose is pipeline planning and execution management. This introduces unnecessary external communication and potential data egress of task status, errors, artifacts, or repository context to a third-party service without clear justification or user consent.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The file mixes English headings with mandatory template content and operational instructions in Spanish such as `Proyecto`, `Objetivo`, `NUNCA modifiques`, and heartbeat directives. There is no indication that language choice is optional or user-configurable, which can violate language/locale policy expectations.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The HEARTBEAT format says 'Un step por heartbeat máximo,' indicating only one step should be executed each cycle. Later, the parallel execution section states the heartbeat may launch multiple parallel steps in one cycle, which is a direct contradiction in the documented operational intent.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The text says each completed step must create a 'commit taggeado' and the heading is 'Git Tagging,' implying creation of a git tag. However, the sample command only performs 'git add' and 'git commit' and does not create any tag, so the operational instruction contradicts the documented claim.

Static analysis

No suspicious patterns detected.